GHSA-6w6h-fwqm-6hjj: Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder

Published Nov 6, 2026

Updated

Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Wazuh Manager to a version that resolves this vulnerability.
Fixed in 4.14.9

Event History

Nov 6, 2026

CVE Published

via OSV·03:00 PM

Data Sourced

via OSV·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Wazuh Manager versions from 3.0.0 before 4.14.9 are affected if an attacker can enroll an agent using passwordless enrollment and submit events to the manager.

What does an attacker need to send to trigger the denial of service?

The attacker must repeatedly send events containing duplicate static JSON fields, such as id. This causes memory to leak in wazuh-analysisd until the process is killed by an out-of-memory condition.

How can I recognize that exploitation may already have occurred?

A likely indicator is wazuh-analysisd consuming increasing memory and being terminated by an OOM kill, resulting in disabled alerting. Review whether newly enrolled or untrusted agents have submitted events with duplicate JSON fields.

GHSA-6w6h-fwqm-6hjj: Wazuh Manager 3.0.0 before 4.14.9 Memory Leak DoS via JSON Decoder

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What does an attacker need to send to trigger the denial of service?

How can I recognize that exploitation may already have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What does an attacker need to send to trigger the denial of service?

How can I recognize that exploitation may already have occurred?